Home / Vulnerability Intelligence / CVE-2026-40621

CVE-2026-40621 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: May 13, 2026

ELECOM Wireless LAN Access Point - Broken Access Control

Published: May 13, 2026Updated: May 13, 2026Remote Exploitable

Overview

ELECOM wireless LAN access point devices contain a broken access control vulnerability caused by lack of authentication on specific URLs, letting attackers access device functions without authentication, exploit requires no special privileges.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 7.5%(Probability of exploitation in next 30 days)

Impact

Attackers can access device functions without authentication, potentially leading to unauthorized configuration changes or information disclosure.

Mitigation

Update to the latest version or apply vendor recommended patches.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 13, 2026

🔴 CVE-2026-40621 - Critical (9.8) ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40621/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-40621
Severity: Critical
CVSS Score: 9.8
Type: broken_access_control
Status: rejected
EPSS: 7.5%
Social Posts: 2

CWE

CWE-288

CVSS Metrics

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

7.5%Probability of exploitation in the next 30 days